Critical Unauthenticated Access Flaw Found in Grafana OnCall
A critical vulnerability in Grafana OnCall allows unauthenticated remote attackers to gain full administrative access via hardcoded default identifiers.
Grafana OnCall versions up to 1.16.11 are affected by a critical vulnerability, tracked as CVE-2026-63087, which permits unauthenticated remote attackers to obtain a valid PluginAuthToken. By sending a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values found in the public source tree, an attacker can bypass authentication mechanisms.
Once a token is acquired, attackers can authenticate against all internal API endpoints. This access allows for the creation of arbitrary Admin users, the revocation of legitimate tokens, and the redirection of API traffic to attacker-controlled hosts by overwriting organization configurations. With a CVSS score of 9.8, this vulnerability poses a significant security risk to affected systems.
Sources
- GitHub Security Advisories Original source
Continue Reading
SecurityNewLXD, MicroCloud flaw lets clients be impersonated
Canonical patched a maximum-severity LXD and MicroCloud bug that let attackers assume a trusted client's identity without its private key.
SecurityA hands-on way to gauge AI ransomware risk
OWASP volunteers released RAID-AI, a free manual self-assessment that maps AI controls to NIST and CISA frameworks.
SecurityAWS AgentCore Flaw Let One Prompt Hijack All Agents
Researchers say a single chat prompt could extract cloud credentials and let an attacker take over every AgentCore agent in an AWS account and region.